Export limit exceeded: 10590 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10590 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116252 | 1 Pgadmin | 1 Pgadmin 4 | 2026-10-30 | 6.5 Medium |
| pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other settings pgAdmin had supplied. A database whose name is such a string, which any role with CREATEDB can create, therefore redirected the psql process pgAdmin starts for the refresh to a host and port of the creator's choosing, and the connecting user's saved server password was presented to that endpoint. It also let the pgAdmin host be made to open connections to arbitrary addresses. The same weakness was fixed for Backup, Restore, Maintenance and Import/Export Data in earlier releases (CVE-2026-86862); the materialized view refresh was the remaining caller. The fix routes the name through the same database_conninfo() helper, so libpq treats it strictly as a database name. This issue affects pgAdmin 4: before 9.19. | ||||
| CVE-2026-118089 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | ||||
| CVE-2026-118090 | 2026-10-30 | 8.8 High | ||
| Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | ||||
| CVE-2026-62131 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | ||||
| CVE-2026-62016 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | ||||
| CVE-2026-62015 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | ||||
| CVE-2026-62014 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | ||||
| CVE-2026-62011 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | ||||
| CVE-2026-62010 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | ||||
| CVE-2026-62009 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | ||||
| CVE-2026-62005 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | ||||
| CVE-2026-62004 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | ||||
| CVE-2026-62003 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | ||||
| CVE-2026-61998 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | ||||
| CVE-2026-61997 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | ||||
| CVE-2026-61992 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | ||||
| CVE-2026-54860 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | ||||
| CVE-2026-54857 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | ||||
| CVE-2026-54856 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | ||||
| CVE-2026-42701 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | ||||